Sniffing Encrypted Traffic (w/ keys)

[Brad DeShong <brad () deshong net>]

During a recent assesment we compromised SSL keys for a webserver and 
wanted to sniff the  "encrypted" traffic.  In theory this works, but 
what tools exist to do this in practice?  I've seen Covelight's 
Clearwatch on a Windows system, but we're working with a Linux system on 
the inside.  Is a MITM necessary or can it be done by just looking at 
the traffic after the fact (at least for the half of the connection we 
have keys for?). 

Thanks,
Brad DeShong
WestAnnex Security